Privacy Policy

1. Who We Are

This Privacy Policy explains how Disfuse ("we," "us," "our") collects, uses, and protects your personal data when you use our platform Wasapia.

2. What Data We Collect

We process two categories of data:

a) Client Account Data (Controller role):

• Name, email, billing details, login credentials.
• Usage logs (access, configuration, error logs).

b) End-User Data from Call Transcripts (Processor role):

• Transcript content (text only, no audio).
• Metadata: phone number, date/time of call.

c) End-Customer Contact List Data (Processor role):

Clients may use the platform to create and manage their own contact lists containing their customers' information. This may include:

• Name, phone number, email address.
• Notes added by the client.
• Any other personal data the client decides to input.

3. How We Use Data

• To provide the transcription service.
• To maintain and improve the platform (e.g., error handling, security monitoring).
• For billing, customer support, and legal compliance.
• We do not sell or use personal data for advertising.

4. Legal Bases for Processing

We process personal data under:

• Performance of a contract (Art. 6(1)(b) GDPR) – to provide our services.
• Legal obligations (Art. 6(1)(c) GDPR).
• Legitimate interests (Art. 6(1)(f) GDPR) – service improvement and security.

5. Data Sharing and International Transfers

• We use third-party providers such as Google Cloud, Amazon Web Services, OpenAI, and Twilio.
• Some providers are located outside the EU/EEA. We ensure adequate safeguards via Standard Contractual Clauses (SCCs) and other GDPR-compliant mechanisms.

6. Data Retention

• Client account data is retained for as long as you maintain an active account, and up to 3 years thereafter for legal/accounting purposes.
• Call transcripts are retained only for the duration necessary to provide the service and as agreed with the client. Upon termination, transcripts are deleted or returned.

7. Your Rights

As an individual, you may exercise your GDPR rights:

• Access, rectification, deletion, restriction, objection, data portability.
• If we process data on behalf of a client (Controller), requests should be directed to them. We will assist the client in fulfilling such requests.
• You may also lodge a complaint with your local Data Protection Authority (Estonia: Andmekaitse Inspektsioon).

8. Security

We apply technical and organizational measures including encryption, access controls, and backups to protect data against unauthorized access, loss, or misuse.

9. Contact

If you have questions about this Privacy Policy or wish to exercise your rights, contact us at:

---